draftgo-cli 3.0.43 → 3.0.44

package/README.md

@@ -353,6 +353,7 @@ checkout 会通过 MCP 获取元数据和专用下载地址，流式写入临时
 - `--allow-offline` / `--no-mcp-setup`：允许 connect 在 MCP 暂不可用时保存，或跳过宿主配置。
 - `--yes`：跳过支持该选项的交互确认。
 - `--mobile-check auto|always|never`：控制 `verify-ui` 是否执行。
+- `--token auto|never`：`verify-ui` 默认读取 `.draftgo/config.json`，对与 `server` 同源的地址自动附加 `token=<SAT>`；配置无 SAT、跨源地址或 `never` 模式均不附加。
 - `--screenshot on-failure|always|never`：控制 UI 截图。
 - `--delivery local|preview|deploy`：控制 deploy 行为。
 - `--timeout <ms>`：控制 connect、MCP test 或 context 的远端请求超时。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "draftgo-cli",
-  "version": "3.0.43",
+  "version": "3.0.44",
   "description": "Install and manage the DraftGo skill across AI coding agents (Claude Code, Codex, Cursor, Windsurf, Antigravity, Copilot, Gemini, Kiro).",
   "bin": {
     "draftgo": "bin/draftgo.js"

package/resources/skill/SKILL.md

@@ -79,7 +79,7 @@ context 一次准备信息
 ### 页面、导航和文档正文
 
 1. 运行 frontend 或 content context，并按需继续通过 MCP 定位资源、取得元数据。
-2. Agent 根据任务自主设计；对已确定的 pages/nav/docs 批量 checkout。
+2. Agent 根据任务自主设计；页面开发优先考虑 Tailwind CSS 作为基础样式方案，并按任务需要搭配现有组件库；对已确定的 pages/nav/docs 批量 checkout。
 3. 按唯一资源 owner 读取、搜索和编辑 `.draftgo/worktree/` 正文；独立资源可并行。
 4. 主 Agent 汇总回读后统一运行一次 `draftgo check`，页面布局或交互变化时再统一运行 `draftgo verify-ui`。
 5. 用 `draftgo diff <type> <id>` 检查全部 base/local 差异，再运行对应的 `draftgo commit ...`。

package/resources/skill/manifest.json

@@ -2,7 +2,7 @@
   "schema_version": "1.0",
   "id": "draftgo",
   "name": "DraftGo 开发助手",
-  "version": "3.0.43",
+  "version": "3.0.44",
   "entry": "SKILL.md",
   "description": "以 context 聚合编排、Skill/reference 原文、MCP 实时发现、长正文 checkout/commit、统一验证和完成日志为边界的 DraftGo 工作流。",
   "license": "MIT",

package/src/commands/help.js

@@ -113,6 +113,8 @@ Important flags:
   --delivery <mode>        (deploy) local | preview | deploy.
   --dry-run                (push) Show diffs without committing.
   --mobile-check <mode>    (verify-ui) auto | always | never.
+  --token <mode>           (verify-ui) auto | never; auto appends the configured
+                           SAT to same-origin URLs as the token query parameter.
   --screenshot <mode>      (verify-ui) on-failure | always | never.
   --browser <name>         (verify-ui) chromium | chrome | msedge.
   --selector <css>         (verify-ui) Require a visible key element.

package/src/commands/verifyUi.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 const log = require('../logger');
+const { configPath, loadProjectConfig } = require('../projectConfig');
 
 const UI_EXTENSIONS = new Set(['.css', '.scss', '.sass', '.less', '.html', '.htm', '.jsx', '.tsx', '.vue', '.svelte']);
 
@@ -50,6 +51,31 @@ function numberFlag(value, fallback, min, max) {
   return Number.isFinite(n) ? Math.max(min, Math.min(max, Math.round(n))) : fallback;
 }
 
+function configuredUiUrl(projectDir, rawUrl, tokenMode = 'auto') {
+  if (tokenMode === 'never') return rawUrl;
+  if (!fs.existsSync(configPath(projectDir))) return rawUrl;
+
+  const config = loadProjectConfig(projectDir, { requireToken: false });
+  if (!config.token) return rawUrl;
+
+  let target;
+  try {
+    target = new URL(rawUrl);
+  } catch {
+    return rawUrl;
+  }
+  const server = new URL(config.server);
+  if (target.origin !== server.origin) return rawUrl;
+  target.searchParams.set('token', config.token);
+  return target.toString();
+}
+
+function redactUrlTokens(message) {
+  return String(message || '')
+    .replace(/([?&]token=)[^&#\s]+/gi, '$1<redacted>')
+    .replace(/\bsat_[A-Za-z0-9._~+/-]+/g, '<redacted>');
+}
+
 function executableCandidates() {
   if (process.platform === 'win32') {
     const roots = [process.env.PROGRAMFILES, process.env['PROGRAMFILES(X86)'], process.env.LOCALAPPDATA].filter(Boolean);
@@ -93,12 +119,18 @@ async function launchBrowser(chromium, requested) {
 }
 
 async function verifyUi(projectDir, positional, flags = {}) {
-  const url = String(flags.url || positional[0] || '').trim();
-  if (!/^https?:\/\//i.test(url)) {
+  const rawUrl = String(flags.url || positional[0] || '').trim();
+  if (!/^https?:\/\//i.test(rawUrl)) {
     log.err('用法：draftgo verify-ui <http://localhost:port/path>');
     return 1;
   }
 
+  const tokenMode = String(flags.token || 'auto').toLowerCase();
+  if (!['auto', 'never'].includes(tokenMode)) {
+    log.err('--token 在 verify-ui 中只支持 auto、never。');
+    return 1;
+  }
+
   const mode = String(flags['mobile-check'] || 'auto').toLowerCase();
   if (!['auto', 'always', 'never'].includes(mode)) {
     log.err('--mobile-check 只支持 auto、always、never。');
@@ -110,6 +142,14 @@ async function verifyUi(projectDir, positional, flags = {}) {
     return 0;
   }
 
+  let url;
+  try {
+    url = configuredUiUrl(projectDir, rawUrl, tokenMode);
+  } catch (err) {
+    log.err(`无法读取 verify-ui 的项目配置：${err.message}`);
+    return 1;
+  }
+
   let chromium;
   try {
     ({ chromium } = require('playwright-core'));
@@ -133,8 +173,8 @@ async function verifyUi(projectDir, positional, flags = {}) {
     const page = await browser.newPage({ viewport: { width, height } });
     const consoleErrors = [];
     const pageErrors = [];
-    page.on('console', (msg) => { if (msg.type() === 'error') consoleErrors.push(msg.text()); });
-    page.on('pageerror', (err) => pageErrors.push(err.message));
+    page.on('console', (msg) => { if (msg.type() === 'error') consoleErrors.push(redactUrlTokens(msg.text())); });
+    page.on('pageerror', (err) => pageErrors.push(redactUrlTokens(err.message)));
 
     const response = await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 });
     if (waitMs) await page.waitForTimeout(waitMs);
@@ -187,7 +227,7 @@ async function verifyUi(projectDir, positional, flags = {}) {
     if (screenshotPath) log.info(`截图：${screenshotPath}`);
     return 0;
   } catch (err) {
-    log.err(`UI smoke check 失败：${err.message}`);
+    log.err(`UI smoke check 失败：${redactUrlTokens(err.message)}`);
     return 1;
   } finally {
     if (browser) await browser.close().catch(() => {});
@@ -198,3 +238,5 @@ module.exports = verifyUi;
 module.exports.decideMobileCheck = decideMobileCheck;
 module.exports.gitChangedFiles = gitChangedFiles;
 module.exports.isUiFile = isUiFile;
+module.exports.configuredUiUrl = configuredUiUrl;
+module.exports.redactUrlTokens = redactUrlTokens;